enable_csp to enable, use catchall instead strictly matching false